Github.com/go-viper/mapstructure/v2: go-viper's mapstructure may leak sensitive information in logs in github.com/go-viper/mapstructure
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 2.4.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: poc
- Automatable: no
- Technical impact: partial
Summary
A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: poc · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- github.com/go-viper/mapstructure/v2
fixed in 2.4.0
- openshift-pipelines-client
Version range not reported
- rhacm2/acm-grafana-rhel9
Version range not reported
- rhacm2/submariner-rhel9-operator
Version range not reported
- advanced-cluster-security/rhacs-central-db-rhel8
Version range not reported
- advanced-cluster-security/rhacs-main-rhel8
Version range not reported
- advanced-cluster-security/rhacs-rhel8-operator
Version range not reported
- advanced-cluster-security/rhacs-roxctl-rhel8
Version range not reported
- advanced-cluster-security/rhacs-scanner-v4-db-rhel8
Version range not reported
- advanced-cluster-security/rhacs-scanner-v4-rhel8
Version range not reported
- redhat-certification-preflight
Version range not reported
- redhat-certification-preflight
Version range not reported
- gvisor-tap-vsock
Version range not reported
- opentelemetry-collector
Version range not reported
- toolbox
Version range not reported
- gvisor-tap-vsock
Version range not reported
- opentelemetry-collector
Version range not reported
- toolbox
Version range not reported
- rhoai/odh-model-registry-rhel9
Version range not reported
- rhoai/odh-rhel9-operator
Version range not reported
- microshift
Version range not reported
- openshift
Version range not reported
- openshift4/ose-helm-operator
Version range not reported
- openshift4/ose-helm-rhel9-operator
Version range not reported
- podman
Version range not reported
- devspaces/traefik-rhel9
Version range not reported
- devspaces/udi-base-rhel9
Version range not reported
- devspaces/udi-rhel9
Version range not reported
- rhosdt/opentelemetry-collector-rhel8
Version range not reported
- openshift-gitops-1/argocd-rhel8
Version range not reported
- openshift-gitops-1/argocd-rhel9
Version range not reported
- rhtap-task-runner/rhtap-task-runner-rhel9
Version range not reported
- rhtas/cosign-rhel9
Version range not reported
- rhtas/fulcio-rhel9
Version range not reported
- rhtas/gitsign-rhel9
Version range not reported
- rhtas/rekor-backfill-redis-rhel9
Version range not reported
- rhtas/rekor-cli-rhel9
Version range not reported
- rhtas/rekor-server-rhel9
Version range not reported
- rhtas/timestamp-authority-rhel9
Version range not reported
- zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9
Version range not reported
- zero-trust-workload-identity-manager/spiffe-spire-oidc-discovery-provider-rhel9
Version range not reported
- zero-trust-workload-identity-manager/spiffe-spire-server-rhel9
Version range not reported
- zero-trust-workload-identity-manager/zero-trust-workload-identity-manager-rhel9
Version range not reported
- github.com/go-viper/mapstructure/v2Go
fixed in 2.4.0
- github.com/go-viper/mapstructureGo
All versions